LDAP Filters Cheat Sheet

A Software › Nope cheat sheet in English by pamymaf

Useful tips to create filters to filter LDAP/Active Directory entries.

8,420 views 1,263 downloads 14 Jul 2022 History

LDAP defini­tions

entry
a collection of inform­ation about an entity
attribute
holds the data for an entry
object­Class
schema elements that specify collec­tions of attribute types that may be related to a particular type of object, process, or other entity
dn
uniquely identifies that entry and its position in the directory inform­ation tree (DIT) hierarchy
rdn
the relative portion of a distin­guished name (DN)
oid
a string that is used to uniquely identify various elements in the LDAP protocol
These are taken from the manual at https:­//l­dap.co­m/b­asi­c-l­dap­-co­ncepts/

LDAP attribute types

cn
common name
name
name, same as cn
dn
distin­guished name
dc
domain component
manager
manager
company
company
department
department
o
organi­zation
ou
organi­zat­ional unit
uid
user id
descri­ption
descri­ption
displa­yName
display name
givenName
first name
sn
surname
title
job title
location
location
l
location
street­Address
first line of address
postalCode
zip code
c
country
st
state
homephone
home phone number
mobile
mobile phone number
teleph­one­Number
office phone number
There are many more available attribute types, consult your LDAP softwa­re's manual

Filter Structure

( )
each component of the search filter is enclosed in parent­hesis
(attri­but­e=v­alue)
the specified attribute must match the specified value
(attri­but­e=val*)
* is a wildcard and will match anything
(attri­but­e=va*e)
wildcards can be anywhere in the string
(attri­bute=*)
this verifies the attribute exists at all
(attri­but­e>=10)
the specified attribute must be larger than 10
(attri­but­e<=10)
the specified attribute must be less than 10
(attri­but­e~=­value)
the specified attribute must be like the value, this has no formal standard and each server may implement it differ­ently
(& (...) (...))
must match all entries
(| (...) (...))
must match at least one entry
(! (...))
negates the result, true becomes false and false becomes true

Example filters

(& (ou=re­search) (! (c=us)))
entries where the organi­zat­ional unit is research and the country is not the united states
(| (telep­hon­eNu­mbe­r=555*) (mobil­eNu­mbe­r=5­55*))
entries where the telephone number starts with 555 or the mobile number starts with 555
(& (| (locat­ion­=riven) (posta­lco­de=­55893)) (title­=ma­nager))
entries where either the location is riven or the post code is 55893 and the job title is manager

Comments

No comments yet.

Cheatography n. The art of mapping complex subjects into clear, instantly navigable reference guides.